Merlin
Cross-platform post-exploitation C2 written in Go, communicating over HTTP/1.1, HTTP/2, and HTTP/3.
Technical Architecture & Overview
Merlin is a Go-based C2 server and agent created by Russel Van Tuyl (Ne0nd0g). Its distinguishing feature is modern protocol support: agents speak HTTP/2 and HTTP/3 (QUIC) as well as HTTP/1.1, with peer-to-peer agents available through the separate merlin-agent repository. JA3 and traffic signatures for Merlin are publicly documented, and real-world abuse of the framework appears in threat reporting.
Targeted Technical Use Cases
Testing detection coverage against QUIC and HTTP/2 C2 traffic during authorized engagements.
Evaluation & Trade-offs
Core Strengths
- +HTTP/3 support is rare among C2 frameworks.
- +Cross-platform agents from a single codebase.
- +Well documented for both operators and defenders.
Trade-Offs & Limitations
- -Feature breadth below commercial C2s.
- -Public detection signatures reduce stealth by design.
Defensive Security Application
Blue team validation of protocol-level detection for modern C2 channels.
Frequently Asked Questions
What is Merlin?→
Merlin is a Go-based C2 server and agent created by Russel Van Tuyl (Ne0nd0g). Its distinguishing feature is modern protocol support: agents speak HTTP/2 and HTTP/3 (QUIC) as well as HTTP/1.1, with peer-to-peer agents available through the separate merlin-agent repository. JA3 and traffic signatures for Merlin are publicly documented, and real-world abuse of the framework appears in threat reporting.
What is Merlin used for?→
Testing detection coverage against QUIC and HTTP/2 C2 traffic during authorized engagements.
What are the strengths of Merlin?→
- +HTTP/3 support is rare among C2 frameworks.
- +Cross-platform agents from a single codebase.
- +Well documented for both operators and defenders.
What are the limitations of Merlin?→
- +Feature breadth below commercial C2s.
- +Public detection signatures reduce stealth by design.
How is Merlin used defensively?→
Blue team validation of protocol-level detection for modern C2 channels.